Privacy Policy

BuildStax, a product of OCIDM. We are the data controller for information about direct users of BuildStax and the data processor for information you upload on behalf of your business customers.

• Account: name, email, hashed password, MFA factors, roles.
• Workspace content: whatever you upload — projects, RFIs, daily logs, photos, contacts, budget, timesheets.
• Payment: we never receive card numbers. Stripe holds them. We store the last-4, brand, and Stripe payment-method IDs.
• Technical: IP, user agent, essential cookies. GPS if you clock in or attach location to a daily log.

To provide the service, secure the platform, detect abuse, comply with legal obligations, and (with your consent) send you product updates.

We do not sell your data, share it for cross-context advertising, or use it to train third-party AI models.

Contract (deliver the service), Legitimate Interest (security, fraud prevention), Consent (marketing email, AI features), and Legal Obligation (tax, breach notification).

Regardless of where you live, you can access, delete, correct, and export your data. Submit via Settings → Privacy or support@ocidm.io. We respond within 45 days per applicable law (GDPR, CCPA, and all US state privacy laws that were in effect as of 2026).

Full detail at docs/soc2/data-retention.md in our public repo. Summary: active workspace data lives while you're a customer + 90 days. Audit + security event logs are kept 7 years. Backups (30-day PITR + 90-day weekly S3) are same-class as source.

Current list at /legal/subprocessors. We give 30 days' notice before adding a new one.

Data is stored in the United States. Where required (EU/UK), we rely on Standard Contractual Clauses. EU-hosted storage available on the Enterprise plan.

BuildStax is not for children under 16. We do not knowingly collect their data.

Privacy: support@ocidm.io. Security: see /.well-known/security.txt. Complaints: contact us first; in EU/UK you may also lodge with your supervisory authority.